CBFS Filter 2020 Python Edition

Questions / Feedback?

filter_rule_control_flags Property

Which control events the rule causes the class to fire (CBFilter only).

Syntax

def get_filter_rule_control_flags(filter_rule_index: int) -> int: ...

Default Value

0

Remarks

Which control events the rule causes the class to fire (CBFilter only).

This property indicates which filesystem operations, of those performed on matching files and directories, the class should fire Control Events for. The value of this property is a combination of zero or more of the following:

FS_CE_NONE0Don't fire for any filesystem operations.

Control Events will not fire for any filesystem operations.

FS_CE_BEFORE_CREATE0x000000000001LFire before file creation operations.

The on_before_create_file event will fire anytime the OS attempts to create a file or directory. In some cases, can cause the on_before_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_CREATE0x000000000002LFire after file creation operations.

The on_after_create_file event will fire after a file or directory creation request has been processed, before the response is returned. In some cases, can cause the on_after_open_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_OPEN0x000000000004LFire before file open operations.

The on_before_open_file event will fire anytime the OS attempts to open a file or directory. In some cases, can cause the on_before_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_AFTER_OPEN0x000000000008LFire after file open operations.

The on_after_open_file event will fire after a file or directory open request has been processed, before the response is returned. In some cases, can cause the on_after_create_file event to fire; refer to the File Create/Open Events topic for more information.

FS_CE_BEFORE_READ0x000000000010LFire before read operations.

The on_before_read_file event will fire anytime the OS attempts to read data from a file.

FS_CE_AFTER_READ0x000000000020LFire after read operations.

The on_after_read_file event will fire after a read request has been processed, before the response is returned.

FS_CE_BEFORE_WRITE0x000000000040LFire before write operations.

The on_before_write_file event will fire anytime the OS attempts to write data to a file.

FS_CE_AFTER_WRITE0x000000000080LFire after write operations.

The on_after_read_file event will fire after a write request has been processed, before the response is returned.

FS_CE_BEFORE_LOCK_CONTROL0x000000000100LFire before lock and unlock operations.

The on_before_lock, on_before_unlock_all, on_before_unlock_all_by_key, and on_before_unlock_single events will fire, as applicable, before the OS attempts to lock or unlock a range of bytes in a file.

FS_CE_AFTER_LOCK_CONTROL0x000000000200LFire before and after lock and unlock operations.

The on_after_lock, on_after_unlock_all, on_after_unlock_all_by_key, and on_after_unlock_single, events will fire, as applicable, after a lock or unlock request has been processed, before the response is returned.

FS_CE_BEFORE_CLEANUP0x000000000400LFire before file handle cleanup operations.

The on_before_cleanup_file event will fire anytime a process closes a file or directory handle.

FS_CE_AFTER_CLEANUP0x000000000800LFire after file handle cleanup operations.

The on_after_cleanup_file event will fire after a file handle cleanup request has been processed, before the response is returned.

FS_CE_BEFORE_CLOSE0x000000001000LFire before file close operations.

The on_before_close_file event will fire anytime the OS closes a file or directory. Also, the on_after_close_enumeration event will fire anytime the OS closes a directory enumeration (which typically occurs immediately before the directory is closed).

FS_CE_AFTER_CLOSE0x000000002000LFire after file close operations.

The on_after_close_file event will fire after a file/directory close request has been processed, before the response is returned.

FS_CE_BEFORE_CAN_DELETE0x000000004000LFire before 'can be deleted' operations.

The on_before_can_file_be_deleted event will fire anytime the OS checks whether a file or directory can be deleted.

FS_CE_AFTER_CAN_DELETE0x000000008000LFire after 'can be deleted' operations.

The on_after_can_file_be_deleted event will fire after a 'can be deleted' request has been processed, before the response is returned.

FS_CE_BEFORE_DELETE0x000000010000LFire before delete operations

The on_before_delete_file event will fire anytime the OS attempts to delete a file or directory.

FS_CE_AFTER_DELETE0x000000020000LFire after delete operations.

The on_after_delete_file event will fire after a delete request has been processed, before the response is returned.

FS_CE_BEFORE_RENAME0x000000040000LFire before rename/move operations.

The on_before_rename_or_move_file event will fire anytime the OS attempts to rename or move a file or directory.

FS_CE_AFTER_RENAME0x000000080000LFire after rename/move operations.

The on_after_rename_or_move_file event will fire after a rename or move request has been processed, before the response is returned.

FS_CE_BEFORE_GET_SECURITY0x000000100000LFire before get security operations.

The on_before_get_file_security event will fire before the OS queries the security attributes of a file or directory.

FS_CE_AFTER_GET_SECURITY0x000000200000LFire after get security operations.

The on_after_get_file_security events will fire after a get security operation has been processed, before the response is returned.

FS_CE_AFTER_ENUMERATE_DIRECTORY0x000000800000LFire for directory enumeration operations.

The on_after_enumerate_directory event will fire after information about a directory entry has been retrieved during directory enumeration, before the response is returned.

FS_CE_BEFORE_QUERY_FILE_INFO0x000001000000LFire before 'query file information' operations.

The on_before_query_file_info event will fire anytime the OS needs to retrieve information about a file or directory.

FS_CE_AFTER_QUERY_FILE_INFO0x000002000000LFire after 'query file information' operations.

The on_after_query_file_info event will fire after a file or directory information query request has been processed, before the response is returned.

FS_CE_AFTER_GET_SIZES0x000008000000LFire after get size operations.

The on_after_get_file_sizes event will fire after a file's size information is retrieved, before the response is returned.

FS_CE_BEFORE_SET_SECURITY0x000010000000LFire before set security operations.

The on_before_set_file_security event will fire anytime the OS needs to change the security attributes of a file or directory.

FS_CE_AFTER_SET_SECURITY0x000020000000LFire after set security operations.

The on_after_set_file_security event will fire after a security attributes change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_ATTRIBUTES0x000040000000LFire before file attribute update operations.

The on_before_set_file_attributes event will fire anytime the OS attempts to change the attributes of a file or directory.

FS_CE_AFTER_SET_ATTRIBUTES0x000080000000LFire after file attribute update operations.

The on_after_set_file_attributes event will fire after a file attributes change request has been processed, before the response is returned.

FS_CE_BEFORE_SET_SIZES0x000100000000LFire before file resize operations.

The on_before_set_file_size event will fire anytime the OS attempts to resize a file, and the on_before_set_allocation_size event will fire anytime the OS attempts to change a file's allocation size.

FS_CE_AFTER_SET_SIZES0x000200000000LFire after file resize operations.

The on_after_set_file_size event will fire after a file resize request has been processed, and the on_after_set_allocation_size event will fire after a file allocation size change request has been processed, before the response is returned.

FS_CE_BEFORE_CREATE_HARD_LINK0x000400000000LFire before hard link creation operations.

The on_before_create_hard_link event will fire anytime the OS attempts to create a hard link.

FS_CE_AFTER_CREATE_HARD_LINK0x000800000000LFire after hard link creation operations.

The on_after_create_hard_link events will fire after a hard link creation request has been processed, before the response is returned.

FS_CE_BEFORE_FSCTL0x001000000000LFire before FSCTL operations.

The on_before_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL request occurs.

FS_CE_AFTER_FSCTL0x002000000000LFire after FSCTL operations.

The on_after_fsctl event will fire after an IRP_MJ_FILE_SYSTEM_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_IOCTL0x004000000000LFire before IOCTL operations.

The on_before_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL request occurs.

FS_CE_AFTER_IOCTL0x008000000000LFire after IOCTL operations.

The on_after_ioctl event will fire after an IRP_MJ_DEVICE_CONTROL request has been processed, before the response is returned.

FS_CE_BEFORE_SET_FILE_INFO0x010000000000LFire before 'set file information' operations.

The on_before_set_file_info event will fire anytime the OS needs to change information about a file or directory.

FS_CE_AFTER_SET_FILE_INFO0x020000000000LFire after 'set file information' operations.

The on_after_set_file_info event will fire after a file or directory information change request has been processed, before the response is returned.

FS_CE_REPARSE_FILENAME0x100000000000LFire before various operations for the purpose of file redirection.

The on_reparse_file_name event will fire before any operation that includes a file or directory name, giving the application a chance to redirect it. This is event is typically used when an application requires more advanced redirection logic than Reparse Rules can provide; please refer to that topic for more information.

FS_CE_REPARSE_TAG0x200000000000LFire for reparse operations.

The on_reparse_with_tag event will fire anytime a file/directory open operation returns a STATUS_REPARSE result, allowing the application to handle the reparse point. Please refer to Microsoft's Reparse Points article for more information.

FS_CE_ALL-1Fire for all filesystem operations.

Control Events will fire for all filesystem operations.

Note: This property is always 0 for the CBMonitor class, which doesn't provide any Control Events for filesystem operations.

The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.

This property is read-only.

Copyright (c) 2022 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 Python Edition - Version 20.0 [Build 8317]